Privacy Policy

Who we are

BioWellth India ("BioWellth," "we," "us") is a functional health intelligence platform. We are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"). That means we decide what personal data is collected and why, and we are responsible for protecting it.

If you have questions about this policy or want to exercise any of your rights, email us at support@mybiowellth.com.

What personal data we collect and why

We collect different types of data for specific purposes. We only collect what is necessary for each purpose.

Account and contact information

Your name, email address, phone number, city, and age range. We collect this when you sign up for early access or create an account.

• Purpose: to create your account, communicate with you about the service, and send updates you've opted into

Blood test reports

PDF or image files of your existing blood work that you upload to the platform.

• Purpose: to provide functional interpretation of your results, generate gap analysis, and create test request lists

Wearable and health device data

If you choose to connect Apple Health or Android Health Connect, we receive the data categories you select. This may include sleep stages, heart rate variability (HRV), skin temperature, activity, and cycle tracking data.

• Purpose: to read your blood work alongside lifestyle and cycle signals for a more complete picture

Self-reported data

Symptoms, energy levels, mood, cycle patterns, and other information you log directly in the app.

• Purpose: to provide personalised AI companion responses and track patterns over time

Usage data

How you interact with the platform, which pages you visit, and basic device information (browser type, screen size). We do not use advertising cookies or tracking pixels.

• Purpose: to understand how people use the site and improve the experience

How we obtain your consent

Under the DPDP Act, we process your personal data based on your consent. When you sign up, we ask for your consent clearly and separately for each type of processing. You will see exactly what you are agreeing to before you agree to it.

Consent is voluntary. You can use parts of the service without consenting to everything. For example, you can upload blood work without connecting a wearable.

You can withdraw consent at any time by emailing support@mybiowellth.com or through your account settings. When you withdraw consent, we will stop processing that data and direct any processors we work with to do the same. Withdrawal does not affect any processing that happened before you withdrew.

Who has access to your data

We do not sell, rent, or share your personal health data with third parties. We do not share it with advertisers or data brokers.

The only parties who may access your data are listed here.

• Our infrastructure providers who host and process data on our behalf (Data Processors under the DPDP Act). They are contractually bound to DPDP-equivalent protections and cannot use your data for their own purposes.
• Payment processors if you make a purchase. We do not store payment card information ourselves.
• Indian law enforcement or regulatory authorities if we are legally compelled to disclose data under applicable Indian law.

We do not transfer personal data to any country that is on the Central Government's restricted list under the DPDP Act. If our infrastructure providers store data outside India, we will disclose which countries and ensure equivalent protections are in place.

How we protect your data

We implement reasonable security safeguards as required under Section 8(5) of the DPDP Act.

• All data is encrypted in transit (TLS) and at rest
• Access to personal data is restricted to systems and personnel that need it to provide the service
• We conduct periodic reviews of our security practices
• Blood test reports and health data are stored separately from account information

Data breach notification

If we become aware of a personal data breach that is likely to cause you harm, we will notify the Data Protection Board of India within 72 hours as required under the DPDP Act. We will also inform you as soon as reasonably possible, explaining what happened, what data was affected, and what steps we are taking.

How long we keep your data

We keep your personal data only as long as it is needed for the purpose it was collected.

• Account data is retained while your account is active. If you delete your account, we erase it within 30 days.
• Blood test reports and health data are retained while your account is active, so you can track trends over time. Deleted within 30 days of account deletion or upon your request.
• Usage data is aggregated and anonymised within 12 months. Once anonymised, it is no longer personal data.
• Legal and regulatory records may be retained longer where Indian law requires it (for example, financial transaction records under the Income Tax Act).

When data is no longer needed and no legal retention requirement applies, we delete it.

Your rights under the DPDP Act

As a Data Principal, you have the following rights.

• Right to access. You can request a summary of the personal data we hold about you and how we are processing it.
• Right to correction. You can ask us to correct any personal data that is inaccurate or incomplete.
• Right to erasure. You can ask us to delete all personal data we hold about you. We will do so within 30 days, unless a legal obligation requires us to retain it.
• Right to withdraw consent. You can withdraw consent for any or all processing at any time.
• Right to grievance redressal. If you believe we have not handled your data properly, you can raise a complaint with us. If you are not satisfied with our response, you have the right to file a complaint with the Data Protection Board of India.
• Right to nominate. You may nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity.

To exercise any of these rights, email support@mybiowellth.com. We will respond within 30 days.

Children's data

BioWellth is designed for adults. We do not knowingly collect personal data from anyone under the age of 18. If we learn that we have collected data from a minor without verifiable parental consent, we will delete it promptly. If you believe a minor has provided us with personal data, please email support@mybiowellth.com.

Aggregated and anonymised data

We use aggregated, anonymised data to improve our algorithms and understand health patterns at a population level. This data cannot be traced back to any individual. It is not personal data under the DPDP Act and is not subject to the rights described above.

Cookies

We use essential cookies to keep the site working (session management, security). We use basic analytics to understand how people use the site. We do not use advertising cookies, tracking pixels, or third-party marketing trackers.

Changes to this policy

If we make significant changes to this policy, we will update this page and notify you by email before the changes take effect. Minor clarifications or formatting changes may be made without notice. The "last updated" date at the top of this page always reflects the most recent version.

Contact

Questions about your data or want to exercise any of your rights? Email support@mybiowellth.com.

If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India once it is operational under the DPDP Act, 2023.

This privacy policy has been written to reflect the requirements of India's Digital Personal Data Protection Act, 2023 and the Draft DPDP Rules, 2025. It has not yet been reviewed by a qualified legal professional. We recommend completing a formal legal review before processing personal health data from users.